IoT modules are currently the product category with the highest volume of export certification applications. Statistics from the company's business database show 40,930 products and 6,103 certificates in the database, covering 16,734 companies in China; the certificate data range is 05/06/2026 to 2026-10-25. In the last 30 days, 1,156 new certificates were issued and 695 new companies were added.
The reason modules rank first is straightforward: a module is a common component for end-product manufacturers, and a single module reused by dozens of manufacturers multiplies certification demand. The industry practice is for the module maker to obtain certification first and for the end-product manufacturer to reference it afterward.
An IoT module with radio transmitting capability must obtain an FCC ID, not an SDoC, to enter the United States. The FCC places radio frequency devices intended for sale to the public under its certification procedure. A module is a typical RF transmitting device, so it follows the Certification path, tested by a qualified laboratory and reviewed by a Telecommunication Certification Body before the grant is issued.
There are three key points:
An IoT gateway mainboard that only carries digital circuitry and no radio can follow the SDoC path. The SDoC cycle is 1-2 weeks.
For an IoT module entering the European Union, the core requirement is the CE-RED directive, and since the EN 18031 series of harmonized standards took effect, cybersecurity has become a mandatory assessment item. CE-RED covers RF performance, electromagnetic compatibility, electrical safety, and health and exposure assessment, and also requires manufacturers to complete a cybersecurity assessment.
The EN 18031 series sets out specific requirements for the cybersecurity, privacy protection and fraud prevention capabilities of radio equipment, covering access control, communication security, software updates, credential management and related aspects. If a module maker only handles RF and EMC and does not prepare cybersecurity documentation, the end-product manufacturer will be blocked during notified body review.
In practice, module makers are advised to prepare the cybersecurity assessment report and declaration of conformity in parallel with the RED testing stage, so that the end-product manufacturer avoids rework.
Radio transmitting equipment sold or used within China requires SRRC type approval. A module is radio transmitting equipment and must submit a type approval application under the Provisions on the Administration of Radio Transmitting Equipment, accepted by the Ministry of Industry and Information Technology and its entrusted bodies.
Type approval focuses on RF parameters such as transmit power, frequency range, occupied bandwidth and spurious emissions. After the module is certified, an end-product manufacturer using that module to build an end product generally does not need to repeat the full RF testing, but the end product must still meet EMC and safety requirements.
| Market | Certification name | Grant/compliance form | Can the module be certified independently | Can the end product reference it |
|---|---|---|---|---|
| United States | FCC ID | Certification | Yes | Yes, authorization and installation instructions must be retained |
| European Union | CE-RED + EN 18031 | Self-declaration + technical documentation | Yes | Yes, the end product requires supplementary assessment |
| China | SRRC type approval | Administrative license | Yes | Yes, the end product still requires EMC and safety |
| South Korea | KC | Certification | Yes | Yes, local marking requirements must be met |
It can simplify, but what is simplified is the test items, not the compliance responsibility. When a certified module is referenced in an end product, the RF conformity testing of the module itself can usually be waived, and the end-product manufacturer only needs to add end-product-level EMC, safety, RF exposure and marking checks.
Three boundaries should be noted:
Prioritize modules that have completed the full certification path for the target markets, rather than modules covering only a single market. Look at four things specifically:
First, check whether the module's certification scope covers all of your target markets, to avoid a second round of certification delaying the launch cycle. Second, check whether the module is certified as a stand-alone module or as a limited module; a limited module pushes more testing responsibility onto the end-product manufacturer. Third, check whether the module maker provides complete authorization documents, antenna specifications and RF exposure assessment materials. Fourth, check whether the module has completed the EN 18031-related cybersecurity documentation — this is the item most often missing in the EU market.
A module with radio transmitting capability must follow the FCC ID certification path; a product with only digital circuitry and no transmitting function can follow SDoC.
Yes. The end product must add end-product-level EMC, safety, RF exposure and marking assessment on top of the module, and the declaration of conformity must be issued in the end-product manufacturer's name.
Yes, they are separate. The module applies for type approval as radio transmitting equipment; when an end product uses an already-approved module, the module RF testing is usually waived, but the end product must still meet EMC and safety requirements.
The EN 18031 series is a harmonized standard under CE-RED, used to presume conformity with the relevant essential requirements on cybersecurity. Without that assessment, the CE-RED compliance chain is incomplete.
Yes, and it is recommended to start them simultaneously. The test items across the four markets overlap, so submitting samples in parallel reduces duplicate testing and sample turnaround time.
Send your product spec and target market — we reply with scope, timeline and cost within one business day.
Email Mr. TaoBeice Testing · Tao Gong · CNAS L5516 · CMA 202319013572 · NTEK Group Partner Lab · Shenzhen, China
+86 199-2684-3993 · taowushuang@ntek.org.cn · 中文站